3 ms·
If it was done through a root account, then sudo su and accessing a shell history should do the trick, right? Please correct me if I'm wrong.
by kunai 13y ago
If it was done through a root account, then
sudo su
and accessing a shell history should do the trick, right? Please correct me if I'm wrong.
- ben1040 13y agoIt would IF they obtained a root shell and started typing commands into it like they were at the console, and that they didn't just go ahead and delete the history file right afterwards. But if someone's used a privilege escalation method on some vulnerable software and injects code that makes system() calls as the root user, that's not going to show up in root's shell history. Shell history is just a convenience for the user typing things in the shell; it doesn't log everything that goes on in the box as that given user, and isn't an audit trail.